CVE-2024-31211

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-312127.2InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacke CVE-2024-312135.4InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when bein CVE-2024-312149.6Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device ima CVE-2024-312154.3Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnera CVE-2024-312165.1The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositori CVE-2024-312176.5Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media uploa CVE-2024-312189.8Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and e CVE-2024-312194.3Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allow CVE-2024-31224.9CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with ad CVE-2024-312207.3Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to CVE-2024-312215.9Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all device CVE-2024-312235.3Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable us